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MEMORANDUM FOR: Office of Medical Services/DDA 
Office of Security/DDA . 
Chief, Policy Guidance and Legal Affairs Control/ 
PCS/DDO 
Chief, Central Cover Staff/DDO 


egislative Counsel 


SUBJECT : HEW Draft Bill Entitled "Privacy of Medical Information 
Act 


1. In June of 1978 the Office of Management and Budget requested 
this Agency's views on subject proposed legislation (copy of draft is 
Attachment A). Subsequently the Office of Legislative Counsel, in 
coordination with appropriate CIA components, forwarded a views letter 
(Attachment B) containing our comments on the proposed bill. 


24. Section 1185 of the draft bill mandates that medical care facilities 
shall not disclose medical information on a former patient to other than 
the patient or his designee unless the individual has authorized the 
disclosure, As it was not then clear in the bill how one defined patient, 
CIA took the position that the bill was intended to protect American 
citizens and possibly permanent resident aliens. Recently, we have 
received a letter from Secretary of Health, Education and Welfare 
Joseph Califano. In an attachment to his letter, Mr. Califano makes 
clear that 


"The draft bill would cover all medical information 
contained by Medicare and Medicard medical care facilities, 
irrespective of the citizenship of the patient." (emphasis 
adde 


3. In light of the foregoing, CIA's views have been requested anew. 
It is requested that addressees consider in detail what deleterious affect, 
if any, this proposed denial of access (without the individual's consent) 
would have on CIA operations or activities. In preparing your response, 
you may wish to consider or provide as appropriate to your office the 
following: 


a. Scope, nature and quantity of CIA activity, if any, 
in this realm that would be affected and how. 
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b. Programs, if any, that would have to be discontinued 
due to the bill's requirement of the individual's consent prior 
to release of medical information. 


c. Pera, andb. above, the importance and value of 
programs, if any. 


d. Separate, if possible, whether programs and 
activities involve only Foreign Nationals, only U.S. 
citizens, or both. In the latter case, please specify 
numbers or percentages in each classification, 


4, Please keep in mind that, due to the way in which the bill is 
drafted, it will be very difficult to secure an amendment that would 
adequately protect CIA activities unless our only interest in this realm 
lies in Foreign Nationals. If that be the case, it will be necessary to 
attempt to secure amendatory langauge limiting the bill's. coverage to 
U.S. persons and permanent resident aliens. Such a course would 
almost necessarily involve the Secretary, Mr. Califano. 


5. It is imperative that I receive your written responses not later 
than close of business 20 November 1978, If you have questions or are 
in need of assistance, please feel free to telephone me at extension 6126, 
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SUMMARY OF DRAFT BILL 


Materials covered by the draft bill 


cataract 


The draft bill would cover "medical information": materials 
relating to tne health, examination, care, or treetment 

of an individual that are in a form enablina the individual 
to be identified. 


Facilities subject to the craft bill 


The draft bill would apply to hospitals, skilled nvursino 
facilities, and intermediate cere facilities varticipatina 
in the Medicare or Medicaid programs. The Secretarv of 
Health, Education, and Welfare could also, bv reaulation, 
apply some or all of the vrovisions of the draft hill to 
other Medicare or Medicaid medicel care Facilities (such 
as clinical laboratories). The draft bill would not 

apply to federal facilities; they are subject to the Free- 
dom of Information Act and to the Privacy Act of 1974. 


Access by an individual t o his-own medical: information 
An individual (or a person desianated by him, if the indi- 
vidual creferred) would have the risht to inspect without 
charge, and be orovided a cony of, any medical information 
that a “gedieal care facility maintained concernina the 
individual. The Secretary could provide that, in certain 
circumstances in which harm mioht result, the individual 
himself would not insvect the medical information, but 
instead would be permitted to desianate an appropriate 
representative to examine the materials. 


Correction of medical information 


Tf an individual reavested a medical care facilitv to correct 
medical information concerning the individual, the facilitv 
would be reauired either to make the correction or to 

explain why it would not make the correction. If the 
facility did not make the correction, it would have to 

file with the medical information the individual's reauest 
for the correction and his reasons for recuestine the correc- 
tion. The correction (or the individual's reauvest) would 
have to be included in future disclosures of the medical 
informetion, and be srovided to anvone named by the indi- 
vidual to whom the information had been previously disclose?,. 
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2 
Notification concerning unauthorized disclosures 


Medical care facilities would be reovired to orovide advance 
written notification of the disclosures of medical information 
that could be made without an individval's consent, ané 

would have to state the procedure, if anv, by which an 
individual could learn of each kind cf disclosure. 


Limitation of disclosure to vroperly- identis ied- persons 


peering! a 
and to purpose for -which- needed 


A disclosure of medical information could be made onlv ta 
properly identified persons and, as a general. rule, onlv 

to the extent needed to accomplish the purvose for which 

the disclasure was made. 


Conditions for disclosure of ‘medical information 


The draft bill would prohibit medical care institutions 
from disclosing medical information, except for certain 
specified kinds of disclosure (see below), or unless 

an individual had signed an apwropriate authorization 

for the disclosure of medical information concerning him. 


Authorization for disclosure of medical - information 


An individual, in order to pérmit disclosure of medical 
information concerning him, wovld have to sian an authori- 
zation that was dated, made clear that the facility was 
among those authorized to disclose informetion about hir, 
was specific as to the information to be disclose, stateA 
to whom the information covld be disclosed, svecified 

the purposes for which the information could be used, and 
specified the exoiration date or event of the authorization. 
An individual could revoke his authorization at anv time. 
The institution would have to ‘een on file. as part of the 
medical information a copy of the individual's authorization. 


Disclosure without: an: individual's: consent 


are abe. De 


A medical care institution could disclose medical information 
without an individual's consent under the follcewing cir- 
cumstances: 


1. to Erployers of or other persons responsible 
to the facility, to the extent needed to carry 
out tree duties, 


2. to health vrofessionals assistina in carina for 
the individual, 


Approved For Release 2005/08/03 : CIA-RDP81M00980R000700080022-3 


Approved For Release 2005/08/03 : CIA-RDP81M00980R000700080022-3 


3. in compellina circumstances affecting the health 
ex safety of the individual or another person, 
but the facility would have to keep on file 
as part of the medical information a notation 
of the disclosure, and would have to inform the 
individual if his health or safety were involved, 


4, for use in a biomedical, epidemiologic, or health 
services research project, or a health statistics 
project, if-- 


A. the disclosure did not violate any 
limitations established when the 
information was obtained, 


B. the importance of the project and the 
Gisclosure were sufficiently great, 


C. the head of the project vrovided adequate 
assurances that the information would 
be protected and that there would he a 
vrogram to remove or destroy materials 
identifying the individual (unless 
there were good health, research, or 
Statistics reasons not to), and 


D. the head of the project provided assurances 
that further use or disclosure of the 
information would not be permitted, 
except for other research or health 
statistics purposes or under certain 
other specified circumstances, 


5. to properly identified persons who stated they 
needed the information for a federal, state, or 
local government audit or evaluation purpose, 
to carry out the Maternal and Child Health, ~ 
Professional Standards Review Organizations, 
Medicare, or Medicaid orograms, or to investigate 
cuestionable activities under those programs, if 
the institution made a notation of the disclosure 
and had a procedure by which the individual could 
learn of the disclosure, 


6. for a non-governmental audit or evaluation purpose, 
if adequate assurances were provided that the 
information would be protected, that there would 
be a program to remove or destroy materials 
identifyine the individual, and that further use 
or disclosure would not be vermitted excent under 
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certain specified circumstances, and if the 
institution made a notation of the disclosvre 

and had a procedure by which the individual coulda 
learn of the Gisclosure, 


7. pursuant to a law authorizina disclosure to a 
bublic health authority, but the facility would 
have to keep on File as vart of the medical 
information a notation of the disclosure, 


8. to a law enforcement authority, pursuant to 
a law that reouires specific tvnes of information 
to be reported, but the fecilitv would have 
to keep on file with the medical information a 
notation of the disclosure, and inform the indivi- 
dual of the CGisclosure, 


Ww 


- when the information revealed only the presence 
of the individual at the institution or the Pro- 
vision of services to him, his location, or his 
general condition, but only if the individual 
nad not objected to the Gisclosure, and only if 
the information-were not of a kine determined 
by the Secretary to reveal specific information 
about the in@ividual's condition, or 


10. in response to @ summons or subpoena. 


Obtainins medical information throuch: deception 
See See ee ice acne ew ee LE CEDLLON 


Persons who, under false pretenses, requested or obtained 
medical information from a medical care fecilitv would be 
Subject to a fine of not more than $10,000 and imorison~ 


ment for net more than one veer. 
Enforcement 
Echinacea oad 


Indivicuals could brine suit in federal or state court 
against medical care institutions that violated the pro- 
visions of the draft bill (and against persons who reouested 
er obtained medical information under false pretenses), 

and could obtain $1,000 in licuidated damages, reasonable 
attornev's fees, and other approcriate relief. A me@ical 
care institution could permit an institutional review hoard 
(meeting requirements established by the Secretary) to 
Cetermine whether reguests for disclosure for research or 
Statistics purposes were permissible. fn these circumstances: 
an individual could bring suit oniv aceinst the parent institution 
of the board, and could vrevail only if the board had acted 
in an arbitrary or capricious manner. 
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Medical care facilities not in substantial compliance with 
the reavirements of the draft bill would be subject to removal 
from the Medicare and Medicaid programs. 


Disclosure of survevs_ of compliance 

Surveys of compliance conducted by the federal government 
would be subject to the Freedom of Information Act and 

the Privacy Act of 1974. The draft bill would reauire 
surveys of compliance conducted by contractors on behalf 

of the federal government to be made public (except for 

any materials enabling individual patients to be identified). 


Effect on state laws 


Se NES A a SS OD 


The draft bill would override state laws only to the extent 


they were inconsistent with the worovisions of the draft 
bill. 


incomoetent individuals. and individuals suffering | 


Ss. 
health conditions 


Minor 
from 
The bill would orovide for approoriate persons to act 

on behalf of minors (exceot in those circumstances in 

which the Secretary determined it was in the interest of 

a minor to act on his own behalf). incommoetent indi- 
viduals. and individuals not able to act effectively because 
of a health condition. 


Effective date 


The draft bill would take effect 180 days after enactment. 
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A PILL 


TO protect the Drivacy of medical information maintained? hy 
medical care facilities, and for other vurnoses. 
Be it-enacted bythe “Senate “and House of -Pepresentetives 
of the United Stetes “of america -in-Conaress-assembie@, That 
SHORT TITLE | 
Section 1. This Act may be cited as the "Privacy of 
Medical Information Act", | 
PRIVACY OF MEDICAL INFORMATION 
Sec. Z. Title XI of the Social Security Act is amended-- 
(1) by striking out in the hea@ina “ayn PPOFFSSTOmar. 
STANDARDS REVIEW" and inserting instead ", PROFESSIONAL. 
STANDARDS REVIEW, AND PPIVACY OF MPDICAL INFOPMATTON" , and 
(2) by adding after part B the followina new warts: 
“PAPT C--PPIVACY OF MEDICAL INFORMATION 
"ECCESS TO AN INDIVIDUAL'S OWN MEDICAL IMPOPMATTON 
"Sec. 1181. (a) ~A medical care facility shell (excent 
@S provided in subsection (b)), if reauested by an individual, 
provide, at the choice of the individual, (1) the individual, 
(2) the individual and another person (designated by the 
individual) who accompanies him, or (3) a verson desianated 
aed by the individual, with an opportunity to insvect, and 
with a copy of, any medical information that the facility 


7 maintains concerning the individual. The facility mav 
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not impose a charae for permittina such an insvection, 
and may not impose more than 2 reasonable cherae (in anv 
event no greater than the charge imposed on thir? versons) 
for vroviding such a copy. 

“(bB) A medical care facility shall provide an sonro- 
priate person (as defined by the Secretary) desianated 
by the individual with an opportunity to insmect, ane with 
a cooy of, medical information that the facilitv maintains 
concerning the individual, in circumstances in which the 


ecretery determines that the aoplication of the recuire- 


Wi 


ments of subsection (a4) would be Likely to be sufficientty 
harmful to the individual or to another person so as to ovut- 
wate he cesirability of avpiying those reauirements. 
"CORRECTION OF MEDICAL INPOPRMATTON 
"Sec. 1182. If an individual reovests that a wedical 
care Peevey correct medical information that the facility 
maintains concerning the individual, the facility shall, within 
@ reasonadle period of time not to exceed three months, 
either-- 
"(1). make the correction recuested, or 
"(2)(A) inform the individual of its refusal 
to do so, the reasons for the refusal, and of the 
Drocedures, if any, for further review of the refusal, 


and 
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"(B) vermit the individual to file with the 
facility ae concise statement setting forth any cor- 
rection requested, but not-made, by the facility, 
and the reasons for requesting that correction. 

The facility shall, in any subsequent disclosure of medical 
information in which a correction was requested, include 
any correction made, and any statement filed as provided 
under clause (2)(B). The facility shall provide any person, 
specifically designated by the individual, to whom that 
medical information was previously disclosed with a copy 

of any correction made, and of any statement filed as 
provided under clause (2)(B). 


"NOTIFICATION CONCERNING DISCLOSURE WITHOUT AN 
INDIVIDUAL'S AUTHORIZATION 


"Sec. 1183. A medical care facility shall notify 
an individual in writing of the disclosures that may be 
made of medical information concerning an individual with- 
out the authorization of the individual and of the procedure, 
if any, by which the individual can learn of each kind 
of disclosure. The facility shall provide that notification=- 
"(1) when the facility first maintains any 
medical information concerning an individual, 
"(2) when the facility first provides services 
to an individual at least one year after it last 


provided services to the individual, and 
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“(3) when the facility first provides services 
to an individual after the effective date of the 
Act enacting this part. 


“LIMITATION OF DISCLOSURE TO PROPERLY IDENTIFIED 
PERSONS AND TO PURPOSE FOR WHICH NEEDED 


"Sec. 1184. A medical care facilitv may disclose 
medical information only to proverly identified persons, 
and (excenot for disclosures under section 1185(b)(5)) only 
to the extent needed to accomplish the purpose for which 
the disclosure is made. 

"CONDITIONS FOR DISCLOSURE OF MEDICAL INFORMATION 

"Sec. 1185. {(e2@) A medical care facility shall not 
Gisciose medical information that it maintains concerning 
an individual. except as vrovided in subsection (b), 
unless the individual has authorized the disclosure as 
provided in subsection (c) and the facility has complied 
with subsection (d). 

“(b) The vrovision of subsection (a) prohibiting 
Gisclosure of medical information concerning an individual 
shall not apoly to a disclosure by a medical care facility-- 

“(1} to a person employed by or responsible 
to the facility. to the extent that the verson needs 
the information to carry out his duties. | 
"(2) to a health orofessional who is consulted 
by the facility, in connection with health services 


provided to the individual. 


Approved For Release 2005/08/03 : CIA-RDP81M00980R000700080022-3 


Approved For Release 2005/08/03 : CIA-RDP81M00980R000700080022-3 


~ 
= 


"(3) in compelling circumstances affectins 
the health or safety of the individual or another 
person, if-- 

"(A) a notation of such disclosure (ané 

to whom the information was disclosed) is made 

part of the medical information that the facility 

maintains cencerning the individual, and 

"(2) when the circumstances affect the health 
or safety of the individual, the individual igs 
notified of the cisclosure (and to whom the infor- 
mation was disclosed), 

"(4) fer us2 in e biomedical, enidemiologic, or 
health services research project, or a health statistics 
project, if-- 

"(A) the disclosure does not violate any 
limitations placed upon the use or disclosure 

of the information et the time the information 

was obtained, 

"(B) the imvortance of the eroject and 

the disclosure is sufficiently great to warrart 

the disclosure, 

Oo "(C) the person conducting the project 
provides adecuate assurances that unauthorized 
disclosure of the information will be vrevented, 
and that there will be a vorocram to remove or 


destroy materials enabling the individual to be 
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identified, unless the person conducting the 
Project presents an adeauate justificatian of 
a research, statistics, or health nature for 
retaining those materials, and 

"(D) the person conductina the project 
Provides adeauate assurances that further use 
or disclosure of the information will not be 
made, except -- 

"(i) for disclosure to a person 
employed by or responsible to the nerson 
conducting the vroject, to the extent needed 
to carry out the broject, 

"(ii) in compellina circumstances 
effecting the health or safety of the 
individual or enother Derson, 

"(iii) for use in another biomedical, 
evidemiologic, or health services reseerch 
Project, or a health statistics vrotect, 
under the same limitations applicable under 
this part to its use in the original project, 

"(iv) for disclosure to proverlv 
identified persons who State thev need the 
information for a federal, State, or local 
government audit or evaluation burvose 


in relation to the project, 
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in relation to the project Other than a4 
federal, State, or local government audit 
Or evaluation purpose, or 
"(vi) pursuant to an administrative or 
judicial summons or subpoena, 

"(5) to Droperly identified persons who state 
they need the information-~ 

"(A) for a federal, State, or local 
government audit or evaluation purpose, or 
"(B) te carry out a program under title v, 

Part 5 of this title, title XVIII, or title xIx, 

Or to conduct an investigation concerning fraud, 

abuse, or waste under those programs, 
if’a notation of such disclosure (end to whom the 
information was Cisclosed) is made and@ there is a 
procedure by which the individual can learn of 
the disclosure, 

"(6) for an audit or evaluation purpose other 
than a federal, State, or local government audit or 
evaluation Purpose, if-- 

"(A) the person to whom the information 
is to be Cisclosed providas adequate assurances ‘that 
unauthorized @isclosure of the information will be 
orevented, and that there will be a program to remove 
Or Gestroy materials enabling the individual to be 


identified, 
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"(B) the person to whom the information 
is te be disclosed provides adeouvate assurances 
that further use or disclosure of the information 
will not be made, excepvt-- 
"€i) for disclosure to persons 
carrying out the audit or evaluation ourvose, 
"(ii) for disclosure to the verson 


for whom the audit or evaluation is heinag 


"(iii) when recuired bv sexe per or 
State law, and 
"(C) a notation of such disclosure (ane 

tc whom the informatian was disclosed) is made 

and there is a procedure by which the individval 

Can Learn cf the disclosure, 

"(7) voursuant to a federal or State law authorizins 
disclosure to a oublic health authoritv, if a notation 
of such Gisclosvre (and to whom the information was 
disclosed) is made part of the medical information 
that the facility maintains concerning the indivievel, 

"(8) to a law enforcement autnoritv, pursuant to 
feGeral or State law that requires snecific tynes of 


information to be revorted, if-- 
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, whom the information was disclosed) is made 
Dart of the medical information that the facility 
maintains concerning the individual, and 
"{B) the individual is notified of the 
Gisclosure (and to whom the information was 
disclosed), 
"(3)  vevealing only the presence of the individual 
at the facility or the provision of services to the 


individual, his location, or his general condition, 


"{2) the individual has not objected 
to the disclosure, and | 

"(B) the information is not of a kind 
Getermined by the Secretary to reveal specific 
information about the individual's condition, 
or 


"(10) pursuant to an administrative or judicial 


"(c) An é@uthorization for disclosure referred to in 
subsection (a) shall-- 
"{1) be in writing, 
"(2) be dated, 


eee "(3) be signed by the individual, 
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designated by the individual as authorized to disclose 
information concerning the individual, 

"(5) be specific as te the nature of the 
information authorized to be disclosed, 

"(6) state specifically named or generically 
designated persons to whom the information may he 
Gisclosed, 

"(7) be specific as to the purposes for which 
the disclosed information may be used, and 

“(8) specifically state the expiration date or 
event of the authorization. 

An authorization may be revoked in whole or in part at any 
time. 

"(d) & medical facility which discloses medical infor- 
mation that it maintains concerning an individual pursuant to 
an authorization specified in subsection (c) shall make a 
copy of the authorization part of che medical information that 
it maintains concerning the individual. 


“COMPLIANCE WITH THIS PART AS A CONDITION FOR PARTICIPATION 
IN MEDICARE AND MEDICAID 


"Sec, 1186. (a) A medical care facility may not continue 
to participate in the program under title XVIII unless the 
facility provides adequate essurances, and evidence from time 
to time, to the Secretary of its substantial compliance with 


the requirements of sections 1181 through 1185. 
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"(b) A medical care facility may not continue to 
roved For Release 2005/08/03 : CIA-RDP81M00980R000700080022-3 
Saree pete in a program under title XIX unless the 
facility provides adequate assurances, and evidence from 
time to time, to the appropriate State agency of its 
substantial compliance with the requirements of 
sections 1181 through 1185. 
"DUTY OF INSTITUTIONAL REVIEW BOARD 
"Sec. 1187. If an institutional review board under~ 
takes to determine whether medical information maintained 
by a medical care facility may be disclosed because the 
disclosure would not violate section 1184 and would meet 
the requirements of section 1185(¢b)(4), it shall make 
that determination in a manner which is neither arbitrary 
nor cavricious. 
"OBTAINING MEDICAL INFORMATION THROUGH DECEPTION 
"Sec. 1188. nag person who, under false pretenses, 
requests or obtains medical information concerning an 
individual from a medical care facility shall be guilty 
of a misdemeanor and upon conviction thereof shall be 
fined not more than $10,000 or imprisoned for not more 
than one year, or both. 
"CIVIL SUITS 
"Sec. 1189. (a) Any person aggrieved by-~ 
"(1) a violation by a medical care facility of 
any provision of sections 1181 through 1185, 
"(2) a violation by an institutional review 


board of section 1187, or 
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"(3) the commission of acts which constitute 

a crime under section 11838, 
May bring @ civil action in any appropriate United 
States district court, without regard to the amount 
in controversy, or in any cther court of competent 
jurisdiction, against, in case of a violation 
under clause (1), the medical care facility, in case of 
a violation under clause (2), the parent entity of the 
institutional review board, or, in case of the commission 
of acts under clause (3), the gerson wno committed 
the acts, and may obtain approoriate relief, including 
$1,000 in liquidated damages, compensatory damages, 
reasonable attorney's fees and reimbursement for 
other reasonable litigation costs, and, where circumstances 
warrant, Dunitive damages and equitable relief. 

"(b) It shall be a defense to an action brought 
against a medical care facility under subsection (a)(1} 
for a violation of section 1184 or 1185(a) that an 
institutionel review board determined that the disclosure 
involved violated neither section 1184, nor section 1185(a) 
because of the applicability of section 1185(b)(4). 

“DISCLOSURE OF SURVEYS OF COMPLIANCE 

"Sec. 1190. (a) Any limitation in section 1106 

concerning the disclosure of information shall not apply to 


information (except for materials in medical information 
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enasiing an individual to be identified) containea in survevs 
of compliance with the orevisions of this part coné@ucteA 
by or for the Secretary. 

"(b) If the Secretary enters into a contract for 
concucting a survey of compliance with the provisions of 
this part, the contract shall recuire the contractor 
to make available to the Secretary wae for vublic insnection 
ali information (except for materials in medical information 
enabling an individual to he identified) obtained for, and 
any reports resulting from, that survey. 

"EFFECT ON STATE LAWS 

"Sec. 1191. This part shall override State laws 
only to the extent that those laws are inconsistent with 
the orovisiocns of this part. 

"DEFINITIONS AND FELATED MATTERS 
"Sec. 1192. For purposes of this pvart-—- 
"(1) ‘medical information’ concerning an individval 
means materials that-- 
"(A)(i) contain informetion reletins to 
the health, examination, care, or treatment of 
the individual, cr (ii) are to be added to such 
“+-- | | ’ materials under provisions of this part, and 
"(B) are in a form enabling the individual 
~s to be identified, 


"(2) "medical care facilitv'=-- 
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: "“(A) means an entitv, other than a federal 
entity. that (i) is a hospital, skilled nursing 
facility. or intermediate care facility, as defined for 
purvoses of title XVIII or XIX. and (ii) has been 
aoproved by the Secretary for participation in 
the program under title XVIII. or certified 
by a State agency for participation in a vrogram 
under title XIX, and 

“(B) means, but anly with respect to those 
provisions that the Secretary makes applicable to 
an entity by regulation, an entity. other than a 
federal entity, that (i) is an entity (other than 
a hosvitsl, skilled nursing facility. or intermediate 
care facility. as defined for purposes of 
title XVIII or XIX) for which approval by the 
Secretary is required for participation in 
Oz coverage under the program under title 
XVIII, oz for which certification by a State 
agency is required for participation in a auauean 
under title XIX, and (i:) has been approved 
by the Secretary for pazticipation in or coverade 
under the program under title XVIII, or certified 
by a State agency for participation in a program 
under title XIX, a 
"(3) the rights of, and obligations with respect ta. 

an ena tytainats shall be exercised by. and discharged through. 


respectively-- : 
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“(A) in the case of an individual under 18 
vears Of age. a parent or quardian of ene indiv- 
idual. excent (i) in those circumstances in 

which the Secretary determines that it is 

in the interest of the individual to exercise 

his own riahts and to have obligations with 

resvect to him discharaed through him. or 

(il) as otherwise provided in subclause (B). 

and 

"(B) in the case of an incompetent or deceased 
individual (or of an incompetent parent or guardian 

under subclause (A)). or of an individual (or of a 

parent or guardian under subclause (A)}) suffering 

from a health condition which the Secretary deter- 
tines orevents the individual {or parent or 
quar@ian) from acting effectively on the individual's 
behalf. such other person as determined by 

the Secretary, 

"(4) 2 reauirement to provide a notification or other 
matter to a person shall be satisfied if the notification 
Or matter is sent to the last known address of the person. 

“(5) ‘arbitrary’ and ‘capricious' have the meanings 
of those terms under 5 U.S.C. 706(2)(A).. and 

“(6) ‘institutional review board' means-- 

"(A) such a board under section 474(a) of 


the Public Health Service Act. or 
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reguirements as the Secretary may specify.” 
EFFECTIVE DATE 


Sec. 3. This Act is effective 180 days after its 


enactment. 
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Office of Legislative Counsel 
“© JUN 979 


Mr. James M. Frey 
Assistant Director for 
Legislative Reference 
Office of Management and Budget 
Washington, D.C. 20503 oe 


Dear Mr. Frey: 


a 


I am writing in response. to your request for the views of this Agency 
on HEW's draft legislation, entitled the "Privacy of Medical Information Act.” 


In our view, the draft bill does not apply to the Central Intelligence 
Agency. The term “medical care facility” (section 1192, page 13), in 
establishing those organizations to which the bill would apply, excludes 


types of health services which CIA provides its employees would not qualify 
under the draft Jegislation's definition of “medical care facility." 


of the United States and possibly permanent resident aliens. In order 
to be absolutely clear on this point, we urge that such definition he 
included in the body of the draft or that it be clearly explained in 


interests therewith. We would appreciate being kept advised of the 
progress of this proposal, particularly as regards the issues discussed 
in this letter. . 


Sincerely, | 


SIGNED 


. STAT 
ro eee 
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